CVE-2026-42264 is a set of prototype pollution gadgets in the Axios HTTP adapter, scored CVSS 7.4 (high) in the record. Five settings are read without an own property check. Upgrade Axios to 1.15.2, and patch any package that can pollute Object.prototype.
What's affected
The NVD record lists Axios from 1.0.0 to before 1.15.2, and 1.15.2 is the fixed version. The advisory lists the same range, 1.0.0 and later, with 1.15.2 as the patch.
The five settings named are auth, baseURL, socketPath, beforeRedirect and insecureHTTPParser. The flaw only matters when something else in the same process has already polluted Object.prototype.
How to check if you're exposed
- List every copy of Axios.
npm ls axios
npm explain axios
pnpm why axios
yarn why axios
- Flag any version from 1.0.0 to 1.15.1.
- Audit for the first stage, packages with prototype pollution issues.
npm audit
- Check whether your code or a plugin sets Axios settings from merged, user influenced objects.
What to do now
- Upgrade to Axios 1.15.2 or later and rebuild.
- Fix or replace dependencies with prototype pollution advisories.
- Set
auth,baseURLand similar settings explicitly on your Axios instances, so the code does not depend on inherited values. - Review outbound credentials and logs if a pollution issue was present in your stack.
Why it matters
The classes are CWE-1321 and CWE-915. The merge step in Axios only copies own properties, so settings you never set stay absent. The HTTP adapter then read five of them with plain property access, which also finds values on the prototype chain. The advisory says it already guarded eight other settings with a helper, and these five were missed.
Depending on which setting is polluted, the advisory describes injected credentials, redirected requests, access to local sockets, a callback run on redirects, and a weaker HTTP parser. The KEV flag is false, and I found no report of exploitation in the wild.
Try it yourself
An exploitability check helps you separate a pollution gadget that needs a second flaw from one that is reachable now.
Click through it at your own pace, or open it full screen.
Quick check
Why does a gadget score as high?
The score assumes the first stage exists. Complexity is rated high in the vector because of that, which is why the number sits at 7.4 and not higher.
Sources
Last reviewed: 19 October 2026.
